CVE-2018-10622
Medtronic MyCareLink Patient Monitor Network Credential Weakness
CVE-2018-10622 is a medium vulnerability (CVSS 5.2) in Medtronic 24950 Mycarelink Monitor, published August 10, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. No source names a fixed version.
- Severity
- 5.2 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.36%EPSS, 30th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
What each source reports
CVE List Score used
Medtronic MyCareLink Patient Monitor Network Credential Weakness
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.
- Record
CVE-2018-10622- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-313
- Updated
- 2026-11-02
EUVDEUVD-2018-2694
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.
- Record
EUVD-2018-2694- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h42x-qcjr-3ww7
A vulnerability was discovered in all versions of Medtronic MyCareLink 24950 and 24952 Patient...
A vulnerability was discovered in all versions of Medtronic MyCareLink 24950 and 24952 Patient Monitor. The affected products use per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication and encryption of local data at rest.
- Record
GHSA-h42x-qcjr-3ww7- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-257, CWE-313, CWE-522
- Updated
- 2026-11-02
NVD
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.
- Record
CVE-2018-10622- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - CVSS 3.0
- 7.1 High
CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-313, CWE-522
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-8-7-18.html
cisa.gov/news-events/ics-medical-advisories/icsma-18-219-01
securityfocus.com/bid/105042
github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2018/icsma-18-219-01.json
ics-cert.us-cert.gov/advisories/ICSMA-18-219-01
nvd.nist.gov/vuln/detail/CVE-2018-10622